Great Project, love it! I just inspected your code and I was able to find your supabase key. You have to be careful when you're flagging your env variables with public_, just see next.js env docs
By default all environment variables loaded through .env.local are only available in the Node.js environment, meaning they won't be exposed to the browser.
In order to expose a variable to the browser you have to prefix the variable with NEXT_PUBLIC_
Im relatively new to next.js but I think you would have to move all your critical code to the "backend" part of next.js, eg. in the api folder or in the data fetch options given here . I couldn't find any of the next.js data fetch methods like getStaticProps. With these methods you can for example cache builded files.